AMENDMENTS TO THE CLAIMS : 

This listing of claims will replace all prior versions and listing of claims in the above- 
referenced application. 
Listing of Claims : 

1 . (Currently Amended) A method for detecting an inconsistent data structure 
comprising: 

receiving a specification describing at least one consistency constraint of a data structure; 

and 

dynamically determining during execution of a program whether said data structure 
violates said at least one consistency constrain t, wherein said program is configured to perform 
said dynamically determining as part of consistency checking processing in accordance with one 
or more of: a signal handler that processes a detected fault, a consistency check of only a portion 
of said data structure at a first execution point in accordance with either a previous usage of said 
portion or a subsequent usage of said portion within said program, or at least one user specified 
execution point of said program . 

2. (Original) The method of Claim 1, wherein said specification comprises at least one 
logical formula. 

3. (Original) The method of Claim 2, wherein said specification includes at least one 
consistency constraint expressed in terms of said data structure. 
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4. (Currently Amended) Th e m e thod of Claim 3, A method for detecting an inconsistent 
data structure comprising: 

receiving a specification describing at least one consistency constraint of a data structure; 

and 

dynamically determining during execution of a program whether said data structure 
violates said at least one consistency constraint, wherein said specification comprises at least one 
logical formula, said specification includes at least one consistency constraint expressed in terms 
of said data structure, and 

wherein, prior to dynamically determining whether said data structure violates said at 
least one consistency constraint, it is determined whether repairing the data structure according 
to the at least one consistency constraint will terminate. 

5. (Original) The method of Claim 3, wherein said specification includes a 
description of said data structure. 

6. (Original) The method of Claim 4, wherein said specification includes a 
description of said data structure. 

7. (Original) The method of Claim 1, further comprising: 
representing said data structure as an abstract model; and 
determining consistency constraint violations of said abstract model. 

8. (Original) The method of Claim 7, wherein said specification includes a description of 
said data structure. 

Page 4 of 30 



9. (Original) The method of Claim 8, wherein said specification includes an 
abstract model definition. 

10. (Original) The method of Claim 9, wherein said specification includes an 
internal constraint in terms of said abstract model definition. 

11. (Original) The method of Claim 10, further comprising: 

determining if said internal constraint is violated in accordance with an evaluation of said 
internal constraint. 

12. (Original) The method of Claim 11, wherein said specification includes 

at least one external constraint mapping elements of said abstract model to elements of said data 
structure. 

13. (Original) The method of Claim 10, wherein said description of said abstract model 
includes at least one model definition rule and at least one declaration for one of: a set and a 
relation, said at least one model definition rule representing an element of said data structure in 
at least one of a set and a relation. 

14. (Original) The method of Claim 13, wherein said specification includes 

at least one external constraint mapping elements of said abstract model to elements of said data 
structure. 
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15. (Original) The method of Claim 1, wherein said dynamically determining is 
performed in response to at least one of: an explicit call and a transfer of control to an error 
handler. 

16. (Currently Amended) Th e method of Claim 13, 

A method for detecting an inconsistent data structure comprising: 
receiving a specification describing at least one consistency constraint of a data structure; 
dynamically determining during execution of a program whether said data structure 
violates said at least one consistency constraint; 

representing said data structure as an abstract model; 

determining consistency constraint violations of said abstract model, wherein said 
specification includes a description of said data structure, said specification includes an 
abstract model definition; said specification includes an internal constraint in terms of said 
abstract model definition, and said description of said abstract model includes at least one model 
definition rule and at least one declaration for one of: a set and a relation, said at least one model 
definition rule representing an element of said data structure in at least one of a set and a relation; 
and wherein, prior to dynamically determining whether said data structure violates said at least 
one consistency constraint, it is determined whether construction of said abstract model will 
terminate. 

17. (Original) The method of Claim 16, wherein, prior to dynamically determining 
whether said data structure violates said at least one consistency constraint, it is determined 
whether said at least one model definition rule has cyclic dependencies which involve negation 
operators. 
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1 8. (Original) The method of Claim 1 7, wherein said at least one model definition rule is 
of the form: quantifier, Q, guard, G, and an inclusion constraint, I, and the method further 
comprising: 

translating each guard of each of said at least one model definition rule into disjunction 
normal form including a logical ORing of conjunctions, each of said conjunctions including one 
or more predicates; 

constructing a graph representing said at least one model definition rule, said graph 
including a node for each model definition rule, a normal edge from a first rule to a second rule if 
the inclusion constraint for the first rule uses a set or relation which is also used in a guard of the 
second rule or a quantifier of the second rule, a negated edge from the first rule to the second rule 
if the inclusion constraint for the first rule uses a set or a relation which is negated in connection 
with one of a set or relation of the second rule's guard; and 

determining if there are any cycles in said graph with negated edges. 

19. (Currently Amended) Th e method of Claim 8, A method for detecting an inconsistent 
data structure comprising: 

receiving a specification describing at least one consistency constraint of a data structure; 

and 

dynamically determining during execution of a program whether said data structure 
violates said at least one consistency constraint; 

representing said data structure as an abstract model; and 

determining consistency constraint violations of said abstract model wherein said 

specification includes a description of said data structure; and 

Page 7 of 30 



wherein, prior to dynamically determining whether said data structure violates said at 
least one consistency constraint, it is determined whether repairing said internal constraints will 
terminate. 

20. (Original) The method of Claim 1, further comprising: 

determining whether a memory reference in connection with said data structure is valid 
in accordance with currently allocated memory of said program. 

21. (Original) The method of Claim 1, further comprising: 

repairing said data structure if said data structure violates said at least one consistency 
constraint. 

22. (Currently Amendedl) A method of dynamically repairing an inconsistent data 
structure during program execution comprising: 

receiving at least one inconsistency violation; 

selecting a repair to correct said at least one inconsistency violation; and 
repairing said inconsistent data structure , said repairing including modifying at least a 
portion of said inconsistent data structure . 

23. (Original) The method of Claim 22, further comprising: 
resuming execution of said program. 

24. (Original) The method of Claim 22, further comprising: 

performing said repair and satisfying said consistency constraint. 
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25. (Currently Amended) The m e thod of Claim 22 , A method of dynamically repairing 
an inconsistent data structure during program execution comprising: 

receiving at least one inconsistency violation; 

selecting a repair to correct said at least one inconsistency violation; and 

repairing said inconsistent data structure; and 
wherein said inconsistent data structure is represented in an abstract model, and the method 
comprising: 

repairing said abstract model in accordance with an internal consistency constraint; and 
applying a repair to the inconsistent data structure in accordance with an external 
constraint translating said repair from said abstract model to said inconsistent data structure. 

26. (Original) The method of Claim 22, further comprising: 

repairing said inconsistent data structure in accordance with an internal consistency 
constraint. 

27. (Original) The method of Claim 22, further comprising: 

selecting a repair from a plurality of repairs in accordance with a cost associated with 
each repair. 

28. (Original) The method of Claim 27, wherein said cost is user specified. 
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29. (Currently Amended) Th e method of Claim 27, A method of dynamically repairing 
an inconsistent data structure during program execution comprising: 

receiving at least one inconsistency violation: 

selecting a repair to correct said at least one inconsistency violation; and 
repairing said inconsistent data structure; 

selecting a repair from a plurality of repairs in accordance with a cost associated with 
each repair; and 

wherein said inconsistency violation includes a plurality of conditions, and the method 
further comprising: 

determining which of said plurality of conditions are true; and 

determining a cost for repairing said inconsistency violation in accordance with those 
conditions that are not true. 

30. (Currently Amended) A method of handling an invalid memory reference 
comprising: 

determining whether a memory reference associated with an operation is invalid; and 
if said memory reference is invalid, performing [[a substitute]] an action selected in 

accordance with a type of said operatio n, wherein said type includes at least one of a read 

operation or a write operation [[in place of performing said operation]]. 

31. (Currently Amended) Th e m e thod of Claim 30, further comprising: A method of 
handling an invalid memory reference comprising: 

determining whether a memory reference associated with an operation is invalid; 
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if said memory reference is invalid, performing a substitute action selected in accordance 
with said operation in place of performing said operation ; 

if said memory reference is associated with a read operation, supplying a default value as 
a result of performing said read operation; and 

if said memory reference is associated with a write operation, disregarding said write 
operation. 

32. (Original) The method of Claim 3 1 , wherein at least one invalid read 
operation has a different default value than at least one other invalid read operation. 

33. (Original) The method of Claim 30, wherein said invalid memory access is 
determined during execution of said program. 

34. (Original) The method of Claim 31, wherein said determining is performed in 
accordance with memory allocations associated with a program execution. 

35. (Original) The method of Claim 34, further comprising: 

evaluating said memory reference prior to attempting to access a portion of memory. 

36. (Original) The method of Claim 35, wherein at least one of said read operation and 
said write operation uses one of: a pointer access, and an array element for said memory 
reference. 
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37. (Original) The method of Claim 36, wherein a program having an invalid memory 
reference continues execution following execution of said substitute action. 

38. (Original) The method of Claim 32, wherein a program having an invalid memory 
reference continues execution following execution of said substitute action. 

39. (Currently Amended) A computer program product that detects an inconsistent data 
structure , the computer program product comprising executable code stored thereon for 
execution by a processor that: 

receives a specification describing at least one consistency constraint of a data structure; 

and 

dynamically determines during execution of a program whether said data structure violates said 
at least one consistency constrain t, wherein said program is configured to perform said 
dynamically determining as part of consistency checking processing in accordance with one or 
more of: a signal handler that processes a detected fault, a consistency check of only a portion of 
said data structure at a first execution point in accordance with either a previous usage of said 
portion or a subsequent usage of said portion within said program, or at least one user specified 
execution point of said program . 

40. (Original) The computer program product of Claim 39, wherein said specification 
comprises at least one logical formula. 

41. (Original) The computer program product of Claim 40, wherein said specification 

includes at least one consistency constraint expressed in terms of said data structure. 
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42. (Currently Amended) Th e comput e r program product of Claim 41 , A computer 
program product that detects an inconsistent data structure, the computer program product 
comprising executable code stored thereon for execution by a processor that: 

receives a specification describing at least one consistency constraint of a data structure; 

dynamically determines during execution of a program whether said data structure 
violates said at least one consistency constraint, wherein said specification comprises at least one 
logical formula, said specification includes at least one consistency constraint expressed in terms 
of said data structure; and 

furth e r comprising executabl e cod e that, prior to dynamically determining whether said 
data structure violates said at least one consistency constraint, determines whether repairing the 
data structure according to the at least one consistency constraint will terminate. 

43. (Original) The computer program product of Claim 41 ? wherein said specification 
includes a description of said data structure. 

44. (Original) The computer program product of Claim 42, wherein said specification 
includes a description of said data structure. 

45. (Original) The computer program product of Claim 39, further comprising 
executable code that: 

represents said data structure as an abstract model; and 
determines consistency constraint violations of said abstract model. 
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46. (Original) The computer program product of Claim 45, wherein said specification 
includes a description of said data structure. 

47. (Original) The computer program product of Claim 46, wherein said specification 
includes an abstract model definition. 

48. (Original) The computer program product of Claim 47, wherein said specification 
includes an internal constraint in terms of said abstract model definition. 

49. (Original) The computer program product of Claim 48, further comprising 
executable code that: 

determines if said internal constraint is violated in accordance with an evaluation of said 
internal constraint. 

50. (Original) The computer program product of Claim 49, wherein said specification 
includes at least one external constraint mapping elements of said abstract model to elements of 
said data structure. 

51. (Original) The computer program product of Claim 48, wherein said description of 
said abstract model includes at least one model definition rule and at least one declaration for one 
of: a set and a relation, said at least one model definition rule representing an element of said 
data structure in at least one of a set and a relation. 
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52. (Original) The computer program product of Claim 51, wherein said specification 
includes at least one external constraint mapping elements of said abstract model to elements of 
said data structure. 

53. (Original) The computer program product of Claim 39, wherein said executable code 
that dynamically determines is responsive to at least one of: an explicit call and a transfer of 
control to an error handler. 

54. (Currently Amended) Th e comput e r program product of Claim 51, furth e r comprising 
e xecutabl e cod e that, A computer program product that detects an inconsistent data structure, the 
computer program product comprising executable code stored thereon for execution by a 
processor that: 

receives a specification describing at least one consistency constraint of a data structure; 
dynamically determines during execution of a program whether said data structure 
violates said at least one consistency constraint; 

represents said data structure as an abstract model; 

determines consistency constraint violations of said abstract model wherein said 
specification includes a description of said data structure, said specification includes an abstract 
model definition, said specification includes an internal constraint in terms of said abstract model 
definition, said description of said abstract model includes at least one model definition rule and 
at least one declaration for one of: a set and a relation, said at least one model definition rule 
representing an element of said data structure in at least one of a set and a relation; and 

prior to dynamically determining whether said data structure violates said at least one 

consistency constraint, determines whether construction of said abstract model will terminate. 
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55. (Original) The computer program product of Claim 54, further comprising 
executable code that, prior to dynamically determining whether said data structure violates said 
at least one consistency constraint, determines whether said at least one model definition rule has 
cyclic dependencies which involve negation operators. 

56. (Original) The computer program product of Claim 55, wherein said at least one 
model definition rule is of the form: quantifier, Q, guard, G, and an inclusion constraint, I, and 
the computer program product further comprising executable code that: 

translates each guard of each of said at least one model definition rule into disjunction 
normal form including a logical ORing of conjunctions, each of said conjunctions including one 
or more predicates; 

constructs a graph representing said at least one model definition rule, said graph 
including a node for each model definition rule, a normal edge from a first rule to a second rule if 
the inclusion constraint for the first rule uses a set or relation which is also used in a guard of the 
second rule or a quantifier of the second rule, a negated edge from the first rule to the second rule 
if the inclusion constraint for the first rule uses a set or a relation which is negated in connection 
with one of a set or relation of the second rule's guard; and 

determines if there are any cycles in said graph with negated edges. 

57. (Currently Amended) The computer program product of Claim 4 6, further comprising 
e x e cutabl e cod e that. A computer program product that detects an inconsistent data structure, the 
computer program product comprising executable code stored thereon for execution by a 
processor that: 
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receives a specification describing at least one consistency constraint of a data structure; 
dynamically determines during execution of a program whether said data structure 
violates said at least one consistency constraint; 

represents said data structure as an abstract model; and 

determines consistency constraint violations of said abstract model wherein said 
specification includes a description of said data structure; and 

prior to dynamically determining whether said data structure violates said at least one 
consistency constraint, determines whether repairing said internal constraints will terminate. 

58. (Original) The computer program product of Claim 39, further comprising 
executable code that: 

determines whether a memory reference in connection with said data structure is valid in 
accordance with currently allocated memory of said program. 

59. (Original) The computer program product of Claim 39, further comprising 
executable code that: 

repairs said data structure if said data structure violates said at least one consistency 
constraint. 

60. (Currently Amended) A computer program product that dynamically repairs an 
inconsistent data structure during program executio n, the computer program product comprising 
executable code stored thereon for execution by a processor that: 

receives at least one inconsistency violation; 

selects a repair to correct said at least one inconsistency violation; and 
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repairs said inconsistent data structure , said repairs including modifying at least a portion 
of said inconsistent data structure . 

61 . (Original) The computer program product of Claim 60, further comprising 
executable code that: 

resumes execution of said program. 

62. (Original) The computer program product of Claim 60, further comprising executable 
code that performs said repair and satisfies said at least one consistency constraint. 

63 . (Currently Amended) The computer program product of Claim 60, A computer 
program product that dynamically repairs an inconsistent data structure during program 
execution, the computer program product comprising executable code stored thereon for 
execution by a processor that: 

receives at least one inconsistency violation; 

selects a repair to correct said at least one inconsistency violation; 

repairs said inconsistent data structure; and 
wherein said inconsistent data structure is represented in an abstract model, and the computer 
program product comprising executable code that: 

repairs said abstract model in accordance with an internal consistency constraint; and 

applies a repair to the inconsistent data structure in accordance with an external constraint 
translating said repair from said abstract model to said inconsistent data structure. 
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64. (Original) The computer program product of Claim 60, further comprising 
executable code that: 

repairs said inconsistent data structure in accordance with an internal consistency 
constraint. 

65. (Original) The computer program product of Claim 60, further comprising executable 
code that: 

selects a repair from a plurality of repairs in accordance with a cost associated with each 

repair. 

66. (Original) The computer program product of Claim 65, wherein said cost is user 
specified. 

67. (Currently Amended) Th e comput e r program product of Claim 65, A computer 
program product that dynamically repairs an inconsistent data structure during program 
execution, the computer program product comprising executable code stored thereon for 
execution by a processor that: 

receives at least one inconsistency violation; 

selects a repair to correct said at least one inconsistency violation; 

repairs said inconsistent data structure; 

selects a repair from a plurality of repairs in accordance with a cost associated with each 
repair: and 

wherein said inconsistency violation includes a plurality of conditions, and the computer 

program product further comprising executable code that: 
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determines which of said plurality of conditions are true; and 
determines a cost for repairing said inconsistency violation in accordance with those 
conditions that are not true. 

68. (Currently Amended) A computer program product that handles an invalid memory 
reference comprising executable code stored thereon for execution by a processor that: 

determines whether a memory reference associated with an operation is invalid; and 
if said memory reference is invalid, performs [[a substitute]] an action selected in 

accordance with a type of said operation 3 wherein said type includes at least one of a read 

operation or a write operation [[in place of performing said operation]]. 

69. (Currently Amended) Th e computer program product of Claim 68, furth e r comprising 
e x e cutabl e cod e that: A computer program product that handles an invalid memory reference 
comprising executable code stored thereon for execution by a processor that: 

determines whether a memory reference associated with an operation is invalid; and 

if said memory reference is invalid, performs a substitute action selected in accordance 
with said operation in place of performing said operation; 

if said memory reference is associated with a read operation, supplies a default value as a 
result of performing said read operation; and 

if said memory reference is associated with a write operation, disregards said write 
operation. 



read 



70. (Original) The computer program product of Claim 69, wherein at least one invalid 
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operation has a different default value than at least one other invalid read operation. 

71. (Original) The computer program product of Claim 68, wherein said invalid memory 
access is determined during execution of said program. 

72. (Original) The computer program product of Claim 69, wherein said executable code 
that determines is performed in accordance with memory allocations associated with a program 
execution. 

73. (Original) The computer program product of Claim 72, further comprising 
executable code that: 

evaluates said memory reference prior to attempting to access a portion of memory. 

74. (Original) The computer program product of Claim 73, wherein at least one of said 
read operation and said write operation uses one of: a pointer access, and an array element for 
said memory reference. 

75. (Original) The computer program product of Claim 73, wherein a program having an 
invalid memory reference continues execution following execution of said substitute action. 

76. (Original) The computer program product of Claim 70, wherein a program having an 
invalid memory reference continues execution following execution of said substitute action. 
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77. (New) The method of Claim 30, wherein said action includes performing at least one 
of: no action at all, discarding said operation, reading a location other than a location specified 
by the invalid memory reference, writing to a location other than a location specified by the 
invalid memory reference, writing a value other than a value specified by the invalid memory 
reference, or supplying a default value. 

78. (New) The method of Claim 30, wherein there are at least two actions and a first of 
said actions supplies a different value than a second of said actions. 

79. (New) The computer program product of Claim 68, wherein said action includes 
performing at least one of: no action at all, discarding said operation, reading a location other 
than a location specified by the invalid memory reference, writing to a location other than a 
location specified by the invalid memory reference, writing a value other than a value specified 
by the invalid memory reference, or supplying a default value. 

80. (New) The computer program product of Claim 68, wherein there are at least two 
actions and a first of said actions supplies a different value than a second of said actions. 
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